Pattern model
Parts that must work together
IdentifierAuthentication methodSecond factor or passkeyError feedbackRecoverySession and device context
Why this matters
A pattern is not a screenshot. It is a reusable decision model that must preserve intent, state, recovery, and accessibility as layouts change.
Decision framework
Questions to answer before choosing UI
Which method fits the risk?
Match assurance to consequence and support password managers, passkeys, and platform capabilities rather than inventing restrictive input rules.
What can an error reveal?
Balance account-enumeration risk with actionable, accessible recovery guidance and avoid dead-end generic messages.
How does recovery establish trust?
Use verified channels, communicate delays and device effects, and provide support for lost factors without weakening the primary model.
Cross-system baseline
End-to-end accessibility
- Allow paste and password managers
- Do not impose inaccessible cognitive-function tests
- Provide sufficient time and resend guidance
- Keep errors associated with the relevant field
Common mistakes
Failure patterns to test
01
Blocking paste
02
Arbitrary password composition rules
03
Recovery that requires the lost factor
04
Auto-advancing one-time-code fields unpredictably